Privacy Policy - Codex BIM

This page explains how the website codexbim.io processes personal information. It was last updated on 27 October 2026. Publishing this page does not by itself mean every duty under Quebec law is fulfilled. A postal address for the person responsible is still to be confirmed. A written assessment before information is communicated outside Quebec has not been completed. Retention periods for accounts, form records, and uploaded files have not been confirmed.

Privacy officer and contact

Jonathan Roy, CEO, is responsible for the protection of personal information. For any question or request about personal information, write to Jonathan.roy@h4geo.com. Postal address: to be confirmed by Codex BIM. It is not published yet. For a general message about the product, you can also write to info@codexbim.io.

Information we collect

We collect only the information described below. On a form, we collect it after you tick the agreement box for that request. A separate product-news box is optional and stays unchecked unless you tick it. Ticking the request box does not agree to product news.

Form details, where the form asks for them: name, work email, company, role, jurisdiction, and message. A demonstration request may also include a date and time. A support request may also include the Revit version and a description of the issue. A release notice or a province notice asks for your email. An order form, when that form is used, may also ask for a phone number, a billing address, a city, a province or state, a postal code, a country, and an optional tax number.
The email address you enter to receive the sample report.
Account details: username, email address, and password. The password is stored only as a hash. You may also save your name and company. If you choose Continue with Google, we receive the email address, the name, and a Google account identifier.
Checkout details, if a purchase is started through Stripe: the plan, the billing period, the language of the page, and, if you are signed in, the email address and username on the account. The card number is entered on the Stripe page. This website does not store the card number. The pricing page does not currently show a Buy now button.
Project files you upload while signed in.
Project and review information kept in the Codex BIM cloud on Microsoft Azure, including report files, when you use the signed-in projects area or the Revit plug-in writes a review. When that cloud checks the account, it can also receive the username, name, email address, company, and licence status. The password is not sent.
A short hash of the IP address with a form submission, not the address itself. A sign-in code. A password-reset link.
Your cookie choice, and technical information about pages you open if you allow the Google measurement tag.

Why we collect and use it

Form details are used to answer the request you sent, such as contact, support, a demonstration, an order, or a trial. That reply uses the required box for the request. It does not use the optional product-news box.
An email for a release notice, a province notice, or the first version is used to send that notice when you tick the required box for it. The website stores the request and emails a confirmation. The website code does not run a separate mailing campaign.
Product news is recorded only when you tick the optional box. The website emails a confirmation of that choice.
The sample-report email is used to send the PDF you asked for, and a download link.
Account details are used to create the account, keep you signed in, send a sign-in code, and reset a password.
Checkout details are used to start payment with Stripe. The card number stays on the Stripe page.
Uploaded project files are stored with the account so the signed-in area can keep them.
Cloud project information is used to show and manage your projects, reviews, and report files while you are signed in.
The IP hash is used to limit repeated form submissions. The cookie choice is used to remember whether the Google tag may load.

How we collect it

You type it into a form, the sample-report box, the trial page, or the account screens, and you send the form.
Continue with Google asks Google for the email address, name, and account identifier of that Google account. The website then stores those details in the account.
If checkout is opened, the website sends the checkout details to Stripe. You enter the card on the Stripe page.
You upload a project file while signed in. The file is stored on the website hosting.
When you are signed in, the website sends a short-lived token with your username to the Codex BIM cloud on Microsoft Azure. The password is not sent. The Revit plug-in writes the review content. The website can rename, move, delete, restore, and share items you choose there, including an email address when you invite someone.
The website sets a sign-in cookie after a successful sign-in, and a cookie that remembers your measurement choice. The language of the page is also remembered by a language cookie.
The Google measurement tag loads only after you choose Accept all, or turn measurement on under Customize cookies and save. Reject all leaves it off. Until you choose, it stays off.

Other organizations

These are the organizations the website code can send personal information to. The country where each one keeps it has not been verified, so it is not stated here.

Bluehost hosts codexbim.io. Account records, form submissions, and files uploaded while signed in are stored on that hosting. The public address of that server is in Virginia, in the United States.
Google receives the email address, name, and Google account identifier when you choose Continue with Google. If you allow measurement, Google can also receive technical information about the pages you open. A Google Site Kit container was present on the public website. This policy does not list every Google product that container may include, and it does not state how long Google keeps the information. That has not been confirmed.
Stripe receives the checkout details above if a purchase checkout is opened. The card number is entered on the Stripe page.
The website code can ask Cryptlex to create a licence after a trial request or a confirmed test payment. When that step runs, the email address is included in the licence notes sent to Cryptlex. The licence key is not shown on the website and is not emailed. It is not confirmed that this step is turned on for the public site.
A form can send a check to Cloudflare Turnstile when a site key is saved in the website settings. That check is not confirmed as turned on.
The website sends its messages with its own email function. It does not call a separate mailing-list service. Mailboxes at codexbim.io, and the mailbox Jonathan.roy@h4geo.com, are received by Microsoft 365. A message sent to one of those addresses can include a name, an email address, and the text of a form. The company that sends the website’s outgoing mail, before it reaches the mailbox, has not been confirmed in this policy.
Microsoft Azure stores the Codex BIM cloud at api-codexbim.azurewebsites.net. That cloud keeps project and review information, report files in a private file store, and, when it checks the account, the username, name, email address, company, and licence status. The website does not sign anyone in with Microsoft. The public address of that cloud application is Azure Canada East, in Quebec. The database and the file store have their own location setting inside the Azure account. That setting was not opened for this policy, so it is not confirmed here as the same region. A Microsoft contract covering this storage has not been reviewed for this policy.
No artificial-intelligence service is called by this website to receive personal information.

Information communicated outside Quebec

Before personal information is communicated outside Quebec, Quebec law requires a written privacy impact assessment. The assessment must look at how sensitive the information is, why it is sent, the protections that would apply, including any contract, and the law of the place where it would be kept. The information may be communicated only if that assessment shows it would receive adequate protection. That written assessment has not been completed. This policy does not say the information receives equivalent protection outside Quebec.

These vendors may keep personal information outside Quebec. The country where each one keeps it has not been verified.

Bluehost hosts codexbim.io. Account records, form submissions, and files uploaded while signed in are stored on that hosting. The public address of that server is in Virginia, in the United States.
Google receives the email address, name, and Google account identifier when you choose Continue with Google. If you allow measurement, Google can also receive technical information about the pages you open.
Stripe receives the plan, the billing period, the language of the page, and, if you are signed in, the email address and username on the account, if a purchase checkout is opened. The card number is entered on the Stripe page and is not stored by this website.
Cryptlex can receive the email address in a licence note if a trial or test-payment licence is created. That step is not confirmed as turned on for the public site. The licence key is not shown and is not emailed.
Microsoft 365 receives mail for addresses at codexbim.io, and for Jonathan.roy@h4geo.com. A form notice sent to info@codexbim.io, or a privacy request sent to Jonathan.roy@h4geo.com, can include a name, an email address, and the message. The country where Microsoft keeps that mail has not been verified.
Microsoft Azure stores the Codex BIM cloud, including project and review information, report files, and the account fields named above. The cloud application answers from Azure Canada East, in Quebec. The database and the file store have a separate location setting that was not opened for this policy. A contract with Microsoft that covers this storage has not been reviewed for this policy.

This website does not send personal information to a mailing-list service. It does not call an artificial-intelligence provider.

What the assessment can say today, and what is still missing:

Sensitivity. An email address, a name, the contents of a form, an uploaded project file, and a project or review file kept on Microsoft Azure can be sensitive. A card number is entered on the Stripe page and is not stored here. A password is stored only as a hash.
Purpose. The purposes are the ones listed above: to answer a request, keep an account, send a requested report, show and manage cloud projects while you are signed in, measure a visit after you allow it, and start a checkout if one is opened.
Protections. The website code uses the measures listed under Security. Report files in the Codex BIM cloud are in a private store, and a download link is given only to the signed-in account. A contract with Bluehost, Google, Stripe, Microsoft 365, or Microsoft Azure that covers this communication has not been confirmed for this policy.
Place and law. The Codex BIM cloud application answers from Azure Canada East, in Quebec. Its database and file store have a separate location setting that was not opened for this policy. The website database is on the Bluehost server for codexbim.io, and the public address of that server is in Virginia, in the United States. The country where Google, Stripe, Cryptlex, and Microsoft 365 keep information has not been verified, so the law of those places has not been assessed.
Result. The assessment cannot show adequate protection. It is not finished.

How long we keep it

These periods are set in the website software. Where no period is set, Codex BIM has not confirmed one for this policy. Do not read a missing period as permission to keep the information forever.

A sign-in code is kept for 10 minutes.
A password-reset link is kept for 1 hour.
The sign-in cookie lasts 14 days, or until you sign out. The website keeps up to 8 sign-in sessions for an account.
The cookie that remembers your measurement choice lasts 180 days, or until you choose again.
The sample-report email and its download link are kept for 7 days.
A repeated-submission limit is kept for 1 hour.
Account records, form submissions, and uploaded files have no automatic deletion date in the software. A retention period for them has not been confirmed.
How long Google, Stripe, Bluehost, Cryptlex, Microsoft 365, or Microsoft Azure keep information on their own systems has not been confirmed. Cloud projects and report files have no automatic deletion date in this website.

Security

These are the safeguards this website code implements. This policy does not describe a security certification, encryption of files at rest, or a hosting control that has not been confirmed.

Passwords are stored as a hash, not as the password itself.
The sign-in cookie is limited to this site, is not available to page scripts, and is marked secure when the site is served over HTTPS.
The server stores a hash of the sign-in token, not the token itself.
With a form submission, the website stores a short hash of the IP address, not the address itself.
A licence key created through Cryptlex is not shown on the page and is not emailed.
Report files in the Codex BIM cloud are kept in a private store. The website gives a short-lived download link only after the signed-in account is allowed to open that file.

Your rights

You may ask for access to your personal information, or for a correction. You may also ask for deletion. Write to Jonathan.roy@h4geo.com. Codex BIM replies to that request within 30 days. The software does not delete accounts, form records, or uploaded files on a set date.

You may withdraw consent for product news or for a release or province notice by opening the unsubscribe link in that email. The link stores the withdrawal on the form record and stops those emails for that address. Writing to info@codexbim.io asks for the same withdrawal, but that message does not by itself update the record. A reply to a request already sent, the sample report you asked for, a sign-in code, and a password reset are not those emails.

You may change the measurement choice at any time with Cookie choices in the footer. Reject all leaves the Google tag off on later pages. It does not delete a Google cookie that was already stored in the browser before that choice.

You may also file a complaint with the Commission d’accès à l’information du Québec at https://www.cai.gouv.qc.ca/.

Cookies and measurement

Essential. A sign-in cookie so the account stays signed in. A language cookie so the English or French page stays selected. These stay on. They are not used for advertising.
Choice. A first-party cookie named bc_cookie_choice stores Accept all, measurement only, or Reject all for 180 days.
Measurement. A Google tag can measure visits. It stays off until you choose Accept all, or turn measurement on and save. The website has not confirmed the full list of Google cookies or how long Google keeps that information.

Changes to this policy

This page is the current policy. The date at the top is the date of this version. The website does not automatically email every visitor when the text changes. If a later change needs a new agreement, we ask for that agreement when the information is collected.